feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Controllers/EncountersController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 
@@ -7,6 +8,7 @@ using Microsoft.AspNetCore.Mvc;
 [ApiController]
 [Route("api/v1/encounters")]
 [Produces("application/json")]
+[Authorize]
 public class EncountersController : ControllerBase
 {
     private readonly IEncounterService _encounters;
@@ -21,6 +23,7 @@ public class EncountersController : ControllerBase
     /// <param name="page">Page number (1-based).</param>
     /// <param name="pageSize">Results per page.</param>
     [HttpGet]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status400BadRequest)]
     public async Task<IActionResult> List(
@@ -72,6 +75,7 @@ public class EncountersController : ControllerBase
     /// <param name="id">Encounter id.</param>
     /// <returns>The encounter with related data.</returns>
     [HttpGet("{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<Encounter>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Get(Guid id)
@@ -87,6 +91,7 @@ public class EncountersController : ControllerBase
     /// <param name="req">Target status.</param>
     /// <returns>The encounter id and new status.</returns>
     [HttpPatch("{id:guid}/status")]
+    [AuthorizePermission(ClinicalPermissions.EncountersWrite)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status409Conflict)]
@@ -102,6 +107,7 @@ public class EncountersController : ControllerBase
     /// <param name="id">Encounter id.</param>
     /// <returns>Ordered timeline events.</returns>
     [HttpGet("{id:guid}/timeline")]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Timeline(Guid id)
@@ -109,4 +115,4 @@ public class EncountersController : ControllerBase
         var timeline = await _encounters.GetTimelineAsync(id);
         return Ok(ApiResponse<object>.Ok(timeline));
     }
-}
+}